This template gives Philippine law firms a practical starting structure. It is not legal advice and should not be adopted without qualified review of the firm’s duties, client agreements, systems, and actual use cases.
Replace bracketed roles and choices, attach the firm’s approved-tool register, and test the policy against real work before approval. A policy that employees cannot apply under time pressure will not control the workflow.
Purpose
The firm permits approved AI tools to assist defined legal and administrative workflows. AI supports preparation. Authorized lawyers remain responsible for professional judgment, client advice, filings, and final work product.
Approved tools and accounts
Only tools, plans, accounts, connectors, and configurations approved by the firm may be used for firm work. The technology owner maintains the approved list, administrators, permitted users, renewal dates, and vendor records.
Personal or consumer accounts may not be used for firm information unless expressly approved for a defined purpose.
The approved-tool register should record the service and plan, administrator, permitted users, approved information classes, approved use cases, connected systems, retention settings, vendor-review date, and next review date. Approval of one plan does not approve every product offered by the vendor.
Information boundary
Users must not enter privileged, confidential, personal, sensitive, secret, restricted, or matter-specific information into an AI system unless the firm has approved that system and workflow for the information.
The matter’s access controls continue to apply. A user’s ability to open a file does not automatically authorize uploading it to another service.
The firm classifies information before use. Suggested classes are public, internal, confidential firm, confidential client or matter, privileged, personal or sensitive personal, and specially restricted. The firm should define these terms to match its existing policies and professional obligations.
Where a workflow processes personal data, the firm obtains qualified advice on the applicable requirements. The NPC Advisory No. 2024-04 addresses governance, transparency, lawful processing, security, rights, risk assessment, and human intervention for AI systems processing personal data.
Permitted uses
Approved uses may include research assistance, retrieval from selected firm collections, summarization, comparison, chronology preparation, proofreading, and first drafts. Each approved workflow names its sources, users, reviewer, records, and acceptance standard.
Prohibited uses
Unless the firm approves a narrower exception after qualified review, users must not:
- enter firm or client information into an unapproved account, plug-in, extension, or connector;
- allow AI to send legal advice, file a document, accept a term, or commit the firm without authorized review;
- cite an authority, quotation, or factual statement that has not been checked against the original;
- bypass matter or role permissions to improve an answer;
- use generated content as the sole basis for a decision affecting a person’s rights;
- conceal a material AI incident or known hallucination in work product;
- represent AI output as reviewed by a lawyer when that review did not occur.
Required lawyer review
AI output is draft material. The responsible lawyer verifies authorities, quotations, facts, calculations, dates, names, legal reasoning, and client instructions. The lawyer checks the original sources and decides whether the output may be used.
AI output cannot serve as the sole basis for legal advice, a filing, or a decision affecting a person’s rights.
The reviewing lawyer records acceptance in the manner required for the workflow. Review is not satisfied by reading for tone. It includes the original source, client instruction, material facts, calculations, authorities, quotations, and legal conclusion relevant to the work.
Records and disclosure
The firm decides which prompts, source files, outputs, edits, approvals, and disclosures must be retained for each workflow. Users must follow matter and firm recordkeeping rules.
The firm assigns responsibility for deciding when client, court, counterparty, regulator, or other disclosure is required or appropriate. Users do not improvise that decision from a general policy paragraph.
Incidents
If restricted information enters an unapproved system, a material hallucination reaches a work product, or an agent takes an unauthorized action, the user stops the workflow, preserves relevant records, and alerts the named privacy, security, and supervising contacts.
The incident owner assesses containment, vendor contact, access removal, record preservation, correction, notification, and lessons for the workflow. This template does not determine whether a particular event is a personal data breach, professional violation, or reportable incident. The firm should establish that decision path with qualified advisers before an event occurs.
Training and acknowledgement
Users complete role-appropriate training before access. Training covers the approved accounts, information classes, source checking, review duties, prohibited uses, connectors, and incident route. The firm records acknowledgement and removes access when a user changes role or leaves.
Exceptions
Exceptions must be written, time-limited, tied to a specific workflow and owner, and approved by [role]. An exception does not silently amend the policy for other matters or users.
Governance
The firm reviews approved tools, vendor terms, access, exceptions, incidents, and workflow performance on a defined schedule. New tools and connectors require approval before use.
Minimum policy attachments
The policy becomes operational through attached registers and checklists:
- approved tools and configurations;
- information classification and handling rules;
- approved workflows and responsible partners;
- lawyer review checklist;
- incident contacts and first actions;
- vendor and privacy assessment records;
- training and access register;
- scheduled review and change log.
The Supreme Court’s 2026 human-centered AI framework is written for the Judiciary, not as a private-firm policy. Its emphasis on authorization, assessment, accountability, transparency, privacy, and human judgment offers useful questions when the firm reviews these attachments.
Use the ChatGPT risk guide and private versus public cloud comparison when adapting the policy.
Source ledger
Sources used and checked
Verified July 13, 2026. Links may change after publication.
- Guidelines on AI systems processing personal dataNational Privacy Commission, accessed July 13, 2026
- SC adopts framework for Judiciary’s use of artificial intelligenceSupreme Court of the Philippines, accessed July 13, 2026